http://bugs.winehq.org/show_bug.cgi?id=24796
--- Comment #2 from Alexandre Julliard julliard@winehq.org 2010-10-20 15:50:00 CDT --- It's calling SetDIBitsToDevice with negative coordinates. A test case would be needed to find out the expected behavior (but crashing probably isn't correct ;-)